Skip to content
OpenAdvisories

Archive

13 August 2026

Vulnerabilities first published on this day (UTC), newest first.

← July 2026 2026 / August /13 September 2026 →
  1. 1157
  2. 250
  3. 3313
  4. 4274
  5. 5429
  6. 6493
  7. 7215
  8. 863
  9. 982
  10. 10671
  11. 11937
  12. 12436
  13. 13606
  14. 14202
  15. 15925
  16. 16111
  17. 17344
  18. 181413
  19. 19680
  20. 20495
  21. 21258
  22. 22239
  23. 2342
  24. 24319
  25. 25770
  26. 26399
  27. 27438
  28. 28497
  29. 2966
  30. 3092
  31. 31358
All Critical High Medium Low Exploited only Public exploit

606 results · Feed

  • High 7.4
    CVE-2026-28189

    WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability

    Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.

    Roland Barker Participants Database
  • High 7.1
    CVE-2026-61960

    WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.

    themeisle WP Full Stripe Free
  • High 7.3
    CVE-2026-28188

    WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.

    themefic Hydra Booking
  • High 7.1
    CVE-2026-28187

    WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 17.211.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.

    Echo Plugins Knowledge Base for Documentation, FAQs with AI Assistance
  • High 8.1
    CVE-2026-28186

    WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.

    themefic Travelfic Toolkit
  • Critical 9.8
    CVE-2026-28185

    WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability

    Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.

    rtcamp Log in with Google
  • Medium 6.5
    CVE-2026-28182

    WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.

    AcyMailing Newsletter Team AcyMailing SMTP Newsletter
  • High 8.8
    CVE-2026-28176

    WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.

    Booking Activities Team Booking Activities
  • Medium 6.5
    CVE-2026-28181

    WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.

    AcyMailing Newsletter Team AcyMailing SMTP Newsletter
  • High 7.1
    CVE-2026-28175

    WordPress Visitors Traffic Real Time Statistics plugin <= 8.11 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.

    wp-buy Visitors Traffic Real Time Statistics
  • Medium 6.5
    CVE-2026-28174

    WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability

    Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.

    Arraytics WP Event Solution
  • High 7.1
    CVE-2026-28173

    WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability

    Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.

    Arraytics WP Event Solution
  • High 7.1
    CVE-2026-28170

    WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.

    1meril Blog Floating Button
  • High 8.5
    CVE-2026-28168

    WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability

    Subscriber SQL Injection in CubeWP <= 1.1.30 versions.

    Imran Tauqeer CubeWP
  • High 8.8
    CVE-2026-28161

    WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability

    Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.

    Aonetheme Service Finder Booking
  • Medium 6.5
    CVE-2026-28159

    WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.

    Aonetheme Service Finder Booking
  • High 7.5
    CVE-2026-28157

    WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability

    Subscriber Path Traversal in Do Lasso <= 358 versions.

    Lasso Analytics Do Lasso
  • High 7.1
    CVE-2026-28158

    WordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.

    Lasso Analytics Do Lasso
  • Medium 6.5
    CVE-2026-28155

    WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.

    Lasso Analytics Do Lasso
  • High 8.5
    CVE-2026-28156

    WordPress Do Lasso plugin <= 358 - SQL Injection vulnerability

    Subscriber SQL Injection in Do Lasso <= 358 versions.

    Lasso Analytics Do Lasso
  • Critical 9.8
    CVE-2026-28149

    WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

    miniOrange Headless Single Sign On
  • Critical 9.8
    CVE-2026-28148

    WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability

    Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.

    miniOrange Headless Single Sign On
  • Critical 9.3
    CVE-2026-28142

    WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability

    Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.

    Shamalli Web Directory Free
  • Critical 9.8
    CVE-2026-28008

    WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability

    Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.

    miniOrange OAuth Single Sign On – SSO (OAuth Client)
  • High 7.1
    CVE-2026-28003

    WordPress Maspik – Spam blacklist plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.

    yonifre Maspik – Spam blacklist
  • High 7.1
    CVE-2026-28004

    WordPress Business Directory plugin <= 6.4.25 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.

    Strategy11 Team Business Directory
  • Critical 9.3
    CVE-2026-28001 Public exploit

    WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

    Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

    Wp Directory Kit WP Directory Kit
  • Medium 6.5
    CVE-2026-27999

    WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.

    themefic Tourfic
  • Critical 10.0
    CVE-2026-27544

    WordPress QA Analytics plugin <= 5.2.0.0 - Remote Code Execution (RCE) vulnerability

    Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.

    QuarkA QA Analytics
  • High 8.1
    CVE-2026-27543

    WordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.

    FluxBuilder MStore API
  • High 7.1
    CVE-2026-27539

    WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.

    Welcart Welcart e-Commerce
  • Medium 6.5
    CVE-2026-27537

    WordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.

    supsystic Popup by Supsystic
  • High 7.5
    CVE-2026-27538

    WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

    Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

    Wp Directory Kit WP Directory Kit
  • High 7.1
    CVE-2026-27536

    WordPress MailChimp Subscribe Forms plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.

    PluginOps MailChimp Subscribe Forms
  • High 7.2
    CVE-2026-27380

    WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability

    Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

    MagePeople Team Car Rental Manager
  • High 7.1
    CVE-2026-27535

    WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.

    solacewp Solace Extra
  • High 7.5
    CVE-2026-27345

    WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

    MagePeople Team Taxi Booking Manager for WooCommerce Web / CMS
  • Medium 5.1
    CVE-2026-19716

    Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

    Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend…

    maalfer Pentestify
  • Medium 4.3
    CVE-2026-21832

    HCL AION is affected by multiple security vulnerabilities.

    HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.

    HCL Software AION
  • Low 3.4
    CVE-2025-62315

    HCL AION is affected by multiple security vulnerabilities.

    HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under ce…

    HCL Software AION